In many sophisticated aircraft, such as helicopters, which are used herein by way of example, there are a variety of hydraulic and electromechanical actuators used for various purposes in the systems which position the control surfaces, thereby to maneuver the aircraft. For instance, in helicopters, it is common to employ a trim actuator which controls the position of a spring detent trim position of the mechanical mechanism that interconnects the pilot control element (such as pedals that control the tail rotor blade pitch for maneuvering in the yaw axis, the cyclic pitch stick which controls main rotor blade switch for maneuvering in the pitch and roll axis, or the collective stick which controls lift). Such actuators operate in response to a position command signal, the actuator driving the trim position until a position detector determines that the trim position is equal to the position command being applied. Of course, if continuously varying position commands are applied, the actuator will continuously slew the trim position in an attempt to catch up. However, any actuator, whether hydraulic or electromechanical, has a certain inherent driving rate, dependent upon the overall gain of the servo loop and the characteristics of the actuator.
In order to detect faults in the actuator, it has been known to provide an electric approximation of the actuator servo loop (referred to hereinafter as a model), apply the same position commands to the model as are applied to the actuator servo loop, and compare the trim position achieved by the actuator with a position determined by the model to be that which the actuator should achieve. Deviations in the two positions are indicative, in simply theory, of actuator servo loop failure. The problem with this simple theory is that all actuators have not only an inherent Lag (that is to say, the time at which the actuator achieves a certain trim position being delayed from the time that a command for that position is applied thereto), but also have variations in such lags. Thus, a hydraulic actuator loop may have variations in lag due to hydraulic pressure and temperature, and the like. Additionally, no two actuators will be exactly alike. Severe loading of hydraulic actuators can slow down their response. And, electromechanical actuators are very load dependent, and any variation in the loading thereof tends to vary the rate of response.
Furthermore, when the particular actuator involved is one which drives a resilient trim position, the pilot can override the trim position by forcing his control (such as a stick or pedals), and in fact increase the loading of the actuator to the point where it may stall completely and never reach the intended trim position.
In an attempt to overcome these difficulties, actuator fault detection systems known to the prior art have provided a rate limit on the position command signal which is applied both to the actuator and to the model. The rate limit is chosen so as to limit the rate at which commanded positions can change to a rate which is below the minimum rate of response (maximum lag) for all reasonable circumstances applicable to a given type of actuator. Thus, in theory, the actuator should always be able to follow the limited-rate input command, and therefore the model need simply integrate that command at a suitable scale factor in order to determine exactly where the trim position should be. However, this severely limits the speed of response of the actuator servo loop itself, thereby degrading aircraft performance. On the other hand, if the input command is less severely rate limited, then actually permissible lags in excess thereof will cause false indications of fault (nuisance faults). This in turn reduces pilot confidence in the system and requires pilot workload in order to determine that only nuisance faults are involved.
In the case of trim actuators, whenever the pilot moves his control it applies forces against the trim position, which are reflected back to the actuator. In order to avoid nuisance faults in such cases, the fault detection has been inhibited during the application of force by the pilot. However, in this circumstance, there is a risk that a real actuator fault will occur, the pilot will override the run-away actuator, and the fault is ignored at a precise time when it should be sensed.